Skip to content

fix(magic env) HEX secrets creating double the length of their name#9820

Open
yipfram wants to merge 2 commits intocoollabsio:nextfrom
yipfram:update-homarr
Open

fix(magic env) HEX secrets creating double the length of their name#9820
yipfram wants to merge 2 commits intocoollabsio:nextfrom
yipfram:update-homarr

Conversation

@yipfram
Copy link
Copy Markdown
Contributor

@yipfram yipfram commented Apr 27, 2026

Changes

  • Divided Str::random

Issues

Fixed SERVICE_HEX_64 or 32 or 128 generating double their size name

SERVICE_HEX_64 would create a 128-character chain, 32=>64 and 128=>256

Because hex = 2 characters when converting.

  • Fixes

Category

  • Bug fix
  • Improvement
  • New feature
  • Adding new one click service
  • Fixing or updating existing one click service

Preview

AI Assistance

  • AI was NOT used to create this PR
  • AI was used (please describe below)

If AI was used:

  • Tools used:
  • How extensively:

Testing

I could not test it in local environment for coolify, i can't get it to run.
I did test by using SERVICE_HEX_32 to generate a 64 character secret, it works.

Contributor Agreement

Important

  • I have read and understood the contributor guidelines. If I have failed to follow any guideline, I understand that this PR may be closed without review.
  • I have searched existing issues and pull requests (including closed ones) to ensure this isn't a duplicate.
  • I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.

Copilot AI review requested due to automatic review settings April 27, 2026 09:44
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes the generated length of SERVICE_HEX_* magic environment variables so the produced hex string matches the size indicated by the suffix (e.g., _64 => 64 hex chars), rather than being doubled.

Changes:

  • Adjust HEX_32, HEX_64, and HEX_128 generation to use half-length inputs before bin2hex(), producing the intended output length.

Comment on lines +1466 to +1469
$generatedValue = bin2hex(Str::random(16));
break;
case 'HEX_64':
$generatedValue = bin2hex(Str::random(64));
$generatedValue = bin2hex(Str::random(32));
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bin2hex(Str::random(...)) hex-encodes an alphanumeric string (ASCII bytes), not raw random bytes, which reduces entropy and produces a biased hex distribution. For cryptographic secrets, generate bytes with random_bytes() (or an equivalent crypto-safe byte generator) and then bin2hex() those bytes, keeping the requested output length consistent (e.g., 32 hex chars => 16 bytes).

Copilot uses AI. Check for mistakes.
Comment on lines 1465 to +1469
case 'HEX_32':
$generatedValue = bin2hex(Str::random(32));
$generatedValue = bin2hex(Str::random(16));
break;
case 'HEX_64':
$generatedValue = bin2hex(Str::random(64));
$generatedValue = bin2hex(Str::random(32));
Copy link

Copilot AI Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are no unit tests asserting the output lengths for the HEX_* magic variables, and this change alters those lengths. Add/extend a unit test that calls the env-generation path and verifies that HEX_32/64/128 produce exactly 32/64/128 hex characters (and valid hex).

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants